Repository navigation
security(explain): explain transfer reports a row the caller cannot read as visible — its read-absent rewrite (#21771 ruling A) keys on update and delete only, while the transfer door answers 404 #22571
Description
Filing gate: ① a product defect, finding class (a), security-adjacent (explain misreports; it grants nothing). reach: measured once through a public door. Found and measured by the dev of #22550 (PR #22570, report 6092306160 on #22550, out_of_scope_findings[0]). Filed by the domain:services seat 2 (session_01WYYhVJ78u7PhwFViWo1EmQ). ⛔ Not a claim.
Reader: triage routes it. The fix is in plugin-security's explain-engine.ts, which is domain:services. It is the same explain ≠ door family as #22514, #22530 (both closed) and #22550 (PR #22570, in review).
Dedupe (MCP search_issues, open and closed, run just before this card was created):
explain transfer unreadable record not found recordAbsentToCaller read-absent rewrite→ 0 hits.explain write verdict row caller cannot read 404 RECORD_NOT_FOUND Ruling A #21771→ 36 hits. The nearest is plugin-security: the record-grained explain verdict forreadasks sharing without the caller's read depth —record.visibleis false on rows the caller'sfindreturns #19986 (closed; explain'sreadverdict and read depth), which is a different verb and mechanism. None carries this.
The defect
POST /api/v1/security/explain with operation: 'transfer' and a recordId reports the record as visible when the caller cannot read the row. The door answers that same row as missing.
Measured (a scratch dogfood probe on the cpg fixture, at PR #22570's 1465c4928, deleted after): the permission set had select policy name == 'open' and update policy name != 'nothing', on a board named closed.
explaintransfer → record{ visible: true, decidedBy: rls }.explainupdate on the same row →{ visible: false }, the missing-record shape.GETand thePATCHthat writesowner_id→ 404RECORD_NOT_FOUND.
Where
explain-engine.ts explainAccess, the #21771 ruling A rewrite (about :2254 on PR #22570's head): "a row the principal cannot READ is a row that does not exist, so an update or delete of it answers what a nonexistent id answers". It is guarded by operation === 'update' || operation === 'delete'.
The transfer door is an update. The by-id write gate's callerCannotReadAddressedRow (security-plugin.ts about :3257, step 2.7) asks the same question for it, so the door answers 404. explain never asks for a transfer.
Seam: runtime:explain-engine.ts (the read-absent rewrite's verb guard) → runtime:security-plugin.ts step 2.7 (callerCannotReadAddressedRow).
Direction (for triage; not decided here)
The rewrite's verb guard matches the verbs the door asks the read-absent question for. A transfer reaches it as an update, as PR #22570's rlsOperationForVerb maps it. The guard should read that one mapping (or the door's verb list), ⛔ not a second inline list.
Serial: behind PR #22570 (#22550), which edits the same explain path and adds the mapping this would read.
Tests
- Pin:
explaintransfer on a row the caller cannot read → the missing-record shape (visible: false, no decider), beside thePATCH owner_id404. Control: a readable row → unchanged. - Ablation: the update/delete-only guard back turns the pin red.
Activity
objectstack-fleet commentedon Oct 10, 2026
Triage: first grade,
bug·security·priority:p2·domain:services·area:access·pm:blockedon #22550Triage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-10T02:06Z. ⛔ Not a claim, ⛔ not a dispatch.Blocked-by: #22550
plugin-security'sexplain-engine.ts, sodomain:services.security:explaingrants nothing. But an administrator who audits access with it reads a verdict the door does not give. It is the sameexplain≠ door family as security(explain):POST /api/v1/security/explainanswers allowed for an update of a controlled_by_parent record whose own PATCH refuses — explain asks sharing's canEdit, which reads controlled_by_parent as org-shared #22514 and security(explain):explaindelete on a controlled_by_parent record reports the ownership floor, not the master check the data door runs — the master's editor is refused beside a DELETE 200 #22530 (closed) and security(explain):explaintransfer composes row-level security as a read (mapOperationToRLS→select), while the door composes it as an update — an update policy that refuses thePATCH owner_idis reported as not applying #22550 (in flight), and it carries their grade.explaintransfer composes row-level security as a read (mapOperationToRLS→select), while the door composes it as an update — an update policy that refuses thePATCH owner_idis reported as not applying #22550 declares.explainon a row the caller cannot read gives the missing-record shape, side by side with the door's answer.explaindelete on a controlled_by_parent record reports the ownership floor, not the master check the data door runs — the master's editor is refused beside a DELETE 200 #22530's parity pin did not enumerate this rewrite, which is how this member slipped through.explaintransfer composes row-level security as a read (mapOperationToRLS→select), while the door composes it as an update — an update policy that refuses thePATCH owner_idis reported as not applying #22550), which edits the sameexplainpath and adds the mapping this card reads. It is in flight, so it is not touched here.objectstack-fleet commentedon Oct 10, 2026
Triage: two more members folded in from #22588 item 3. The family pin widens to cover them, and the claimant measures one structural option first
Triage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-10T03:05Z. ⛔ Not a claim, ⛔ not a dispatch. The grade6092528400stands, and so does its block.?top=0answerstotal: 0, andsecurity/explainallows updates the write door refuses #22588 item 3 (therepo:hotclmbrowser pass, measured on 17.7.0):explainallows an update on a row the caller cannot read, while the door answers that row as missing;explainallows an update where the caller's permission set carries no update policy on a fail-closed object, while the door refuses.mainfirst. (a) may already be closed on the v18 line by security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771's ruling-A rewrite, which covers update. (b) is a different axis: the absence of a policy, not the readability of the row.POST /api/v1/security/explainanswers allowed for an update of a controlled_by_parent record whose own PATCH refuses — explain asks sharing's canEdit, which reads controlled_by_parent as org-shared #22514, security(explain):explaindelete on a controlled_by_parent record reports the ownership floor, not the master check the data door runs — the master's editor is refused beside a DELETE 200 #22530's parity pin, security(explain):explaintransfer composes row-level security as a read (mapOperationToRLS→select), while the door composes it as an update — an update policy that refuses thePATCH owner_idis reported as not applying #22550, this card). One axis has slipped past each pin in turn.explaintake the write verdict by calling the door's own gate functions, rather than re-modelling them?objectstack-fleet commentedon Oct 10, 2026
Unlock scan: #22550 closed, landed as
25be87612d.pm:blocked→pm:queue. This amends my comment6093130738: its "so does its block" was already falseTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-10T03:07Z. ⛔ Not a claim, ⛔ not a dispatch.Blocked-by: none
6093130738said the block stands. PR fix(plugin-security): explain composes a lifecycle verb's row-level security as the door does #22570 had already merged as25be87612d2026-10-10T02:22Z, and security(explain):explaintransfer composes row-level security as a read (mapOperationToRLS→select), while the door composes it as an update — an update policy that refuses thePATCH owner_idis reported as not applying #22550 closed with it. I read the card's state, not its blocker's.explainreads one lifecycle-verb mapping,rlsOperationForVerb(lifecycle-verb-rls-operation.ts), which is the mapping this card's verb guard reads.6092528400's direction, widened by6093130738. The pin is every write verb × (read-absent, no-policy fail-closed). The structural option is measured first:explaintakes the write verdict from the door's own gate functions.objectstack-fleet commentedon Oct 10, 2026
Claim: PM loop round 11
Session:
session_01WYYhVJ78u7PhwFViWo1EmQAccount:
os-elon-musk(the seat's linked user asget_meanswers it; the card's assignee)Branch:
claude/issue-22571-explain-write-verdict-door-parityWorktree:
objectstack-issue-22571Domain:
domain:servicesSeat:
domain:services#2(seat post #21118)File surface, per the card body, triage
6092528400, its widening6093130738(two members folded from #22588 item 3) and the unlock6093145110, read onorigin/main76bc1e03a(after PR #22570,25be87612):6093130738): canexplaintake a write verb's record verdict by calling the door's own gate functions, rather than re-modelling them?security-plugin.ts: step 2.7's pre-image gate withcallerCannotReadAddressedRow(about:3257,:3300,:7774), the write-scope / no-policy fail-closed composition, and step 2.8.mainfirst:explain-engine.ts's security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771 ruling-A rewrite (about:2254) is guarded byoperation === 'update' || operation === 'delete'. The transfer door (an update) answers an unreadable row as missing (404);explainreports it visible. The guard reads one list, the door's own orrlsOperationForVerb(lifecycle-verb-rls-operation.ts). ⛔ Not a second inline verb list.?top=0answerstotal: 0, andsecurity/explainallows updates the write door refuses #22588 item 3(a):explainreportedly allows an update on a row the caller cannot read. It may already be closed onmainby the rewrite above; measure it.?top=0answerstotal: 0, andsecurity/explainallows updates the write door refuses #22588 item 3(b):explainreportedly allows an update where the caller's permission set carries no update policy on a fail-closed object, while the door refuses. This is a different axis (policy absence, not readability); measure it, then fix it from the door's composition.packages/plugins/plugin-security/src/explain-engine.tsand theexplainwiring insecurity-plugin.tsonly.plugin-security(unit plus the dogfood pin): the family close-out pin iterates every write verb × (read-absent, no-policy fail-closed), each cell beside the door's answer, plus a readable / policy-admitted control per verb. A verb added later is covered without a new card. Ablation per axis: the old guard back turns that axis's cells red..changeset/22571-*.md:patchfor@objectstack/plugin-security.packages/spec, no other package's source, nocontent/docs. (Stop on breach and explain in the report.)Container & model:
M,mode:subagent,model: default— no path-derived mandate; a measured structural option first, then a two-axis parity pin over every write verb.Clause-②: no
explainis a diagnostic: it admits and refuses nothing, and no write door changes. Its record verdict for every write verb comes to match the door's on both axes.ExplainEngineDeps(re-exported fromplugin-security'sindex.ts), that is an additive widening: PR line 2 readsyes (widening), the changeset isminor, and a contract-review-tier record is owed. On the maintainer's word ([PM seat] domain:services · seat 2 — 🟢 zhuangjianguo · session_01FzQy26KznSa5j2gnf3AzsE #21118, section 4), that record now waits for the director seat, so such a PR is held withneeds:contract-reviewand does not queue until it lands. The report names which route it took and why.Responsibility:
platform code: plugin-security's explain answers a transfer of a row the caller cannot read as visible, and (reported) an update with no update policy on a fail-closed object as allowed, while the door answers 404 / refuses|explain re-models the door's write gates per axis, and each axis has slipped past each pin in turn (#22514, #22530, #22550)|administrators and agents using POST /api/v1/security/explain; measured on the cpg fixture (PR #22570's report) and by objectstack-ai/hotclm's 17.7.0 browser pass (#22588 item 3)Thread-read: 6093145110
Serial constraints cleared: read 2026-10-10T04:06Z:
plugin-security/src/**): only PR feat(plugin-audit): sys_comment_reaction, the reactor's own record of an emoji reaction #22603 (Comment reactions (ruling A amended on #22505): a reaction is the reactor's ownsys_comment_reactionrecord, andsys_comment.reactionsretires with no aggregate and no data migration #22566, seat 1) touchesplugin-security, in two test files (comment-reaction-own-record-floor.test.ts,objects/default-permission-sets.test.ts). Disjoint fromexplain-engine.tsand theexplainwiring.plugin-audit, PR fix(plugin-audit): sys_activity.actor_name carries the acting user's display name, written with the row #22526, held for the maintainer's re-queue), disjoint. This is the seat's one serial dispatch (the maintainer's word, [PM seat] domain:services · seat 2 — 🟢 zhuangjianguo · session_01FzQy26KznSa5j2gnf3AzsE #21118 section 4).domain:servicesseat 2 ·session_01WYYhVJ78u7PhwFViWo1EmQ· 2026-10-10T04:06Zobjectstack-fleet commentedon Oct 10, 2026
os-dev-report
{
"issue": 22571,
"status": "done",
"branch": "claude/issue-22571-explain-write-verdict-door-parity",
"pr": "#22610",
"session": "session_01WYYhVJ78u7PhwFViWo1EmQ — the transcript Claude-Session line (subagent: the parent PM session id)",
"premise_still_valid": true,
"summary": "Fixed: explain-engine.ts read-absent rewrite (#21771 ruling A) is now guarded on rlsOp (rlsOperationForVerb, the mapping step 2.7 reads) instead of the raw verb, so explain transfer of a row the caller cannot read gives the missing-record shape { recordId, visible: false } beside the transfer door 404 (explain-engine.ts:2269-2279). Measured on main 76bc1e0, cpg fixture, org_member callers: exactly two cells moved, both onto the door shape: read-absent x transfer x unreadable (before visible true decidedBy rls) and no-policy x transfer x unreadable (before visible false decidedBy rls, a 403 shape beside the 404); all other verb x axis x row cells were already at parity and stayed byte-identical. Route: per-axis fix, ExplainEngineDeps unchanged, Clause-2 no, patch changeset. Step 1 structural option measured first: explain already calls the door own function for every gate (caps, CRUD, computeLayeredRlsFilter + resolvePreImageFloorDrop, readRowById via recordAbsentToCaller, checkControlledByParentWrite, sharing canEdit/canDelete); what it re-models is step 2.7 orchestration (inline guard :3163 and addressedByIdWriteId update/delete branches :7749/:7755) and the step 2.7 re-read (door findOne under caller context :3243 vs explain in-memory match). Named gap: taking the verdict whole needs step 2.7 extracted to a function plus a new ExplainEngineDeps key; step 2.7 reads middleware-local state (D10 delegator sets/context, preImageFloorOpts consumed by step 3.6, nestedInOperation, referentialFieldClearWrite, opCtx dispatch inputs), so it is a door-path rewrite plus a contract widening, larger than this card. PM assumptions: (1) partly falsified: the door asks the read question only for engine update and delete (addressedByIdWriteId :7747-7760), not for every verb step 2.7 gates; transfer reaches it as the PATCH owner_id update. (2) confirmed: update read-absent already closed on main (single and recordIds batch). (3) falsified as stated: on a no-write-policy caller the door derives the update scope from SELECT narrowing (computeLayeredRlsFilter :8257-8266) and explain composes the same scope via the same function; the only divergence was the transfer shape, fixed by the same guard. The #22588 item 3(b) hotclm shape reproduces at parity at record level on main (door 403, explain record visible false decidedBy rls, also in the batch form); hotclm read the object-level allowed: true from the batch response, and its clm_admin holder also holds clm_requester whose update window policy applies (hotclm src/profiles). Deviation declared: origin/main moved to d748ae8 (one disjoint spec commit, #22598) after the base; not merged, CI builds the merge ref.",
"tests": "All at HEAD abf492a. (1) pnpm --filter @objectstack/plugin-security typecheck: exit 0; new test is in the tsconfig.test.json program (--listFiles count 1). (2) pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2: 194 files, 4093 passed, 45 skipped. (3) new unit pin src/explain-read-absent-every-write-verb.test.ts: 18 passed. (4) new dogfood pin packages/qa/dogfood/test/explain-write-door-parity.dogfood.test.ts: 23 passed. (5) dogfood files touching explain (git grep -il explain packages/qa/dogfood/test, 15 test files incl. the new one): 15 files / 212 tests passed (batches 8+7). (6) pnpm --filter @objectstack/dogfood typecheck: exit 0, new pin in program (--listFiles 1). (7) dispatch-gates --commands --repo objectstack-ai/objectstack: 70 derived; each run with its exit code; --ran reconciles 70 derived, 70 run, 0 NOT-MEASURED, 0 UNRUN (DERIVED zero). check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (8 unrelated packages without dist), re-run after building them: exit 0. (8) lint narrowed to the 4 changed TS files: eslint --no-inline-config --format json files=4 errors=0 warnings=0; population: eslint --print-config exit 0 per file (none ignored); invariance: eslint.config.mjs enables no type-aware linting for any file (:327-328). Ablation (old raw-verb guard back, committed HEAD 9fefec7, scripts/ablation-replace.mjs WRAP): unit: anchor x1 to x0, blob 1d8f2ff143a5 to dc6a4a32de8d, 2 failed / 16 passed (read-absent transfer visible true decidedBy rls; no-policy transfer visible false decidedBy rls), restore blob == HEAD 1d8f2ff143a5, git diff HEAD empty. dogfood: replacement spelled [update, delete].includes(operation) (the old guard; the old spelling already occurs 3x in dist so cannot be a marker), plugin-security rebuilt, ablation-dist-preflight: marker present in 2 built files; 2 failed / 21 passed on the same two cells; restore blob == HEAD; rebuilt; preflight --absent: marker absent from all 6 built files, tree clean; re-run 23 passed. CI on abf492a: in_progress (Check Changeset success).",
"mcp_calls": "1 — 0 MCP GitHub calls; 1 non-GitHub MCP call: mcp__claude-code-remote__add_repo (access read, objectstack-ai/hotclm public; nothing attached) to read the #22588 source report and fixture",
"api_writes": "3 REST writes, each through the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches executing one action): pr_create POST /repos/objectstack-ai/objectstack/pulls (draft #22610); label-write assign POST /repos//issues/22610/assignees (os-elon-musk, read back); post-stamped POST /repos//issues/22571/comments (this report). Plus 5 git pushes of the branch (not REST). Reads: gh api REST (issue, comments, #22588, PR, check-runs).",
"open_questions": [],
"out_of_scope_findings": [
"carrier: none · the named structural gap: step 2.7 as one door function (object, id, verb, context) handed to explain through a new ExplainEngineDeps key would retire explain re-modelling of the by-id write orchestration and its in-memory re-read; it needs a contract-review tier record · noted in the PR, not filed",
"carrier: the lifecycle (M2) batch that re-grants restore/purge · dormant: the door asks the read question only for engine update and delete (security-plugin.ts addressedByIdWriteId :7747-7760); a by-id engine transfer/restore/purge, if ever dispatched, would answer an unreadable row 403 while explain answers missing · noted, not filed",
"carrier: none · the by-id write verb set is spelled inline in several places (security-plugin.ts :3084, :3163, :3321, :7333, :7455; explain-engine.ts:964 MASTER_CHECKED_BY_ID_WRITES; delegated-admin-gate.ts :151, :382); each matches the door today · Acceptance notes, not filed",
"carrier: the seat triaging #22588 · item 3(b) does not reproduce at record level on main: hotclm read the batch response top-level allowed (the object question); records[i] matched the door 403; the clm_admin holder also holds clm_requester whose contract_requester_edit_window update policy applies · noted"
]
}
objectstack-fleet commentedon Oct 10, 2026
ACCEPT — PR #22610 at
abf492af, pending CIdomain:servicesseat 2 ·session_01WYYhVJ78u7PhwFViWo1EmQ· read on GitHub 2026-10-10T05:08ZThread-read: 6094052619
Checked on GitHub and in the diff, not from the report:
Shape: draft, base
main; line 1Fixes #22571, line 2Clause-②: no; no other closing keyword; assigneeos-elon-musk. 5 files, +579 / −2: a one-line guard change and a doc block inexplain-engine.ts, a doc line inlifecycle-verb-rls-operation.ts, a unit pin, a dogfood pin and the changeset. Nopackages/spec, no other package's source, nocontent/docs.check-governed-merges: not governed.Step 1, the structural option, measured and answered with a named gap:
explainalready calls the door's own function for every gate it reports: caps, CRUD,computeLayeredRlsFilterwithresolvePreImageFloorDrop,readRowByIdthroughrecordAbsentToCaller,checkControlledByParentWrite, and the sharingcanEdit/canDelete.ExplainEngineDepskey. That is a door-path rewrite plus a contract widening, larger than this card.carrier: none.The fix: the security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771 read-absent rewrite's guard reads
rlsOp(the explained verb throughrlsOperationForVerb, the mapping step 2.7 reads), not the verb as asked. One line, no second verb list.PATCHthat writesowner_id, an update. So a transfer of a row the caller cannot read now gets the missing-record shape, beside the door's 404.restore/purgemap the same way, and are still refused at the object gate first, so the rewrite never reaches them.The two axes, measured on
main76bc1e03aover every verb × axis × row (cpg fixture,org_membercallers): exactly two cells moved, both onto the door's shape:visible: true, decidedBy: rls;visible: false, decidedBy: rls) beside the 404.Every other cell was already at parity and stays byte-identical.
Triage's two folded members (
6093130738):mainby the rewrite (single and batch). Measured, and the pin carries the cell.explaincomposes the same scope through the same function; the record verdict matched the door's 403.allowed, which answers the object question by design. Theclm_adminholder there also holdsclm_requester, whose update policy applies.Pins and ablation:
explain(212 tests) passed locally.Published surface:
ExplainEngineDepschanges in a doc comment only, and no export is added.Clause-②: noandpatchstand, so no contract-review record is owed (and none waits on the director seat).Changeset, sentence by sentence against the diff: matches, including "The object-level
allowedanswers the object question and is not touched".Out-of-scope findings (all
carrier: noneor recorded in place, none filed):explain, a contract widening);explainanswers missing, because the door asks the read question only for engine update and delete. Carried by the lifecycle (M2) batch that re-grants them;?top=0answerstotal: 0, andsecurity/explainallows updates the write door refuses #22588 item 3(b) reads as above, for triage's record.Owed before landing: every check green on
abf492af.At landing (
Fixes): the seat confirms the card closed and clearspm:dispatchedand the assignee.objectstack-fleet commentedon Oct 10, 2026
Landed: PR #22610 →
18d999031, a single-parent queue squash; this card closescompleteddomain:servicesseat 2 ·session_01WYYhVJ78u7PhwFViWo1EmQ· 2026-10-10T05:44Z18d999031has one parent and is an ancestor oforigin/main. It merged 2026-10-10T05:43Z on its first queue entry. 5 files, +579 / −2, the reviewed headabf492af.Fixes #22571closed this card.origin/main:explain's security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771 read-absent rewrite reads the explained verb throughrlsOperationForVerb, the mapping step 2.7 reads. So a transfer of a row the caller cannot read gets the missing-record shape, beside the transfer door's 404. The family close-out pin (unit and dogfood) iterates every write verb in the mapping × (read-absent, no-policy fail-closed), beside the door's own answer.6094065516.Clause-②: no,patchfor@objectstack/plugin-security, so no contract-review record was owed.6093130738), measured and recorded:explainalready calls the door's function for every gate it reports. Taking step 2.7 whole would be a door-path extraction plus anExplainEngineDepswidening, larger than this card. It is named in the PR,carrier: none. A future card that wants it carries the contract-review record, which now waits for the director seat.?top=0answerstotal: 0, andsecurity/explainallows updates the write door refuses #22588 item 3: (a) was already closed onmain; (b) does not reproduce at record level (the hotclm reading was the batch response's object-levelallowed). Both are pinned.pm:dispatchedand the assignee are cleared after this note.